Chifoumi Restaurant – Privacy Policy

Last updated: November 20, 2025

This Privacy Policy explains how the Chifoumi Restaurant application collects, uses, and protects your personal data.

This Application is intended to be used inside the restaurant in a kiosk mode.

1. Data Controller

Chifoumi Restaurant
Crousty n’Thai
43 bis Rue Michelet, 93100 Montreuil, France
support@concours.croustynthai.fr

2. Data We Collect

The Application collects one single type of personal data:

Phone Number

It is used solely to:

• identify the player,
• associate plays, wins or rewards,
• prevent duplicate participation or abuse of the game.

No other personal data is collected.

The Application does not collect:

• name,
• email,
• location,
• photos,
• sensitive data,
• behavioral analytics,
• advertising identifiers,
• phone history or device information.

3. Legal Basis

The processing of the phone number is based on:

• the performance of a service requested by the user (participation in the game),
• the legitimate interest of the restaurant to ensure the proper functioning of the game system.

4. Purpose of Processing

The phone number is used to:

• manage access to the game,
• associate rewards or attempts,
• prevent excessive participation,
• enforce game rules (e.g., one play per day).

No other use is made of this data.

5. Storage and Security

Data is stored in a secured database using:

• Google Firebase
• Firestore Database
• Hosting in the EU when possible, or in secure Google Cloud regions

Firebase certifications include:

• ISO 27001
• ISO 27017
• ISO 27018
• SOC 1 / SOC 2 / SOC 3

Firebase is GDPR-compliant under Google’s standard contractual terms. All communication between the Application and Firebase is encrypted (HTTPS/TLS).

6. Data Retention

The phone number is retained:

• as long as needed for the game to function,
• or until manually deleted upon user request.

The restaurant may delete data at any time.

7. Data Sharing

Data is never sold and not shared with third parties except:

• Firebase/Google, the technical service provider,
• legal obligations, if required.

No advertisers, partners, or social networks have access to the data.

8. User Rights

Under GDPR, users may exercise the following rights:

• right of access,
• right to rectification,
• right to erasure,
• right to object,
• right to restriction of processing.

To exercise your rights, you can contact us at: support@concours.croustynthai.fr

9. Children

The Application is not intended for children under 13, except when used under adult supervision.

10. Contact

For any questions regarding privacy, you can write to: support@concours.croustynthai.fr